GitHub Advisoryadvisory · Packagist

GHSA-fx2m-5m9v-jhgp XSS in baserCMS before 4.1.4

MEDIUM Published 2022-05-14 Modified 2023-07-07 Official page ↗
Aliases
CVE-2018-18943
Ecosystem
Packagist
Packages
baserproject/basercms
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2023-07-07

Affected packages

• Packagist baserproject/basercms: < 4.1.4 → fixed in 4.1.4

Description

An issue was discovered in baserCMS before 4.1.4. In the Register New Category feature of the Upload menu, the category name can be used for XSS via the `data[UploaderCategory][name]` parameter to an `admin/uploader/uploader_categories/edit` URI.

Related

Alias · CVE (1)

  • CVE-2018-18943 An issue was discovered in baserCMS before 4.1.4. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References